The protocol is defined as : Bob want to send message to one of his friends say $k$ friends , he does not want his others friends (except one whom he want to send message ) to tell who is targeted recipient. Here public key of all the participants are known. I read this is anonymous public key encryption in some paper ,but this paper said hat ElGamal public-key encryption is able to provide this type of encryption but RSA cannot . I thought both can able to provide , my question is can we do some mathematical analysis (probabilistic one) to show that ElGamal public-key encryption able to provide this type of encryption but not RSA. Can somebody share me some resources where detail analysis is done.